# Eurapps publishing requirements (for AI coding assistants)

Put this file in the root of your project. If you are an AI coding assistant working in this project: the app
will be published in the Eurapps store, a European store for web apps (PWAs). Every version is checked
automatically and then by a person. Follow every rule below while writing code, and run the self-check at the
end before telling the developer the app is ready. Do not invent exceptions; if a rule blocks a feature, tell
the developer.

## 1. Installable, works like an app
- `manifest.webmanifest` linked from every page, with `name`, `short_name`, `start_url`, `scope`,
  `display: "standalone"`, `background_color`, `theme_color`, `lang`.
- Icons: 192x192 and 512x512 PNG in the manifest (one 512 marked `"purpose": "maskable"`), plus a 180x180
  `<link rel="apple-touch-icon">` for iPhone.
- Layout fits 320–1024 px wide; no horizontal scrolling; respects `env(safe-area-inset-*)`.
- A service worker caches the app so it starts without a connection. If a feature needs the network, show a
  clear message; never a blank page.
- First screen within 3 seconds on a mid-range phone over 4G. Whole app at most 50 MB.
- No errors in the console on start-up or normal use.
- Finished: no "coming soon" screens, test data, placeholder text or buttons that do nothing.
- Accessible: body text at least 16 px, WCAG AA contrast, tap targets at least 44x44 px, labels on controls.
- A real app, not a wrapper that redirects to a website.

## 2. Security
- Ship all code in the package. Never load scripts, styles or remote config at runtime that change what the
  app does after review (no remote JS, no `eval`, no `new Function`).
- No obfuscated code. Minified is fine if you include the original source.
- No crypto mining or hidden background computation.
- No login screens that imitate a bank, government or other company.
- Request camera, microphone, location or notifications only at the moment the user uses that feature, with
  an explanation. Never request permissions the app does not need.
- HTTPS only.
- Set a strict Content Security Policy. List every external origin the app contacts, with the reason; the
  developer must declare this list when submitting.

## 3. Privacy (EU GDPR)
- A privacy statement reachable from inside the app, in the app's language.
- Collect only what the app needs. The developer fills in a data label (what is collected, why, shared with
  whom); the code must match it exactly.
- No trackers, analytics that follow users across sites, or ad networks unless the user opts in first.
  An "accept only" banner does not count.
- Never sell user data. Store data in the EU (or a country with an EU adequacy decision).
- If there are accounts: users can delete their account and data from inside the app. Never require an
  account for features that work without one. Prefer signing in with the store account.

## 4. Content
- Nothing illegal in the Netherlands or the EU. No sexual content, hate, real-money gambling, weapons, drugs,
  tobacco or alcohol. No false medical, financial or legal claims. No fake news or impersonation.
- Only music, images, brand names and characters the developer has the rights to.
- If the app uses AI to talk to users or generate content, say so clearly in the app. No AI images or voices
  of real people without their consent.

## 5. Store page
- Name, description and screenshots show the real app. The name does not resemble a known app or brand.
- What is free and what costs money is stated up front. A contact email that answers within 5 working days.
- Store text in English and Dutch; the app itself may use other languages.

## 6. Payments
- All payments, including in-app extras, go through the store. No payment links or SDKs of your own.
- Prices in euros including VAT. Subscriptions show price, term and how to cancel before purchase;
  cancelling is always one tap. Trials: reminder 3 days before the first charge.
- No pressure tactics: no fake countdowns, no "only 2 left", no hidden costs.

## 7. Children
- Choose an age rating (4+, 9+, 12+, 16+) and state why.
- Apps for children under 13: no ads, no tracking, parental gate for purchases and external links, no chat
  with strangers.

## Self-check before saying "ready"
Run through this and report each item as pass/fail to the developer:
1. Manifest valid and linked; icons 180/192/512 present; `display: standalone`.
2. Starts offline (service worker caches the app shell).
3. No console errors; no dead buttons or placeholder content.
4. No runtime-loaded remote code; CSP set; list of external origins written down with reasons.
5. Permissions requested only on use, with explanation.
6. Privacy statement in the app; data label matches what the code actually collects.
7. Text >= 16 px, tap targets >= 44 px, contrast OK, works at 320 px wide.
8. Total size <= 50 MB; first screen < 3 s on 4G.